https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 14:45:42 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-102673 <p>Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron&#39;s OpenURLFromTab navigation path, including links using target=&#34;_blank&#34; or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application&#39;s full origin, exposing that origin&#39;s cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.</p> <p>Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron&#39;s OpenURLFromTab navigation path, including links using target=&#34;_blank&#34; or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application&#39;s full origin, exposing that origin&#39;s cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-102673 https://db.gcve.eu/vuln/ghsa-hq2x-r82h-9wj4 <p><strong>Affected:</strong> npm: electron</p> <p>### Impact</p> <p>Popups opened from a sandboxed iframe through a link (for example `target=&#34;_blank&#34;` or a middle-click) did not inherit the iframe&#39;s HTML `sandbox` restrictions. Content that was meant to run sandboxed could open a popup with the embedding app&#39;s full origin, gaining access to that origin&#39;s cookies, storage, and same-origin scripting.</p> <p>Apps are only affected if they embed untrusted content in iframes sandboxed with `allow-scripts allow-popups`. Apps that do not embed untrusted content in sandboxed iframes are not affected.</p> <p>### Workarounds</p> <p>Use `setWindowOpenHandler` on the parent `WebContents` to deny or constrain popups opened from sandboxed frames, or do not apply `allow-popups` to sandboxed iframes that render untrusted content.</p> <p>### Fixed Versions</p> <p>* `43.0.0` * `42.5.2` * `41.10.4`</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)</p> <p><strong>Affected:</strong> npm: electron</p> <p>### Impact</p> <p>Popups opened from a sandboxed iframe through a link (for example `target=&#34;_blank&#34;` or a middle-click) did not inherit the iframe&#39;s HTML `sandbox` restrictions. Content that was meant to run sandboxed could open a popup with the embedding app&#39;s full origin, gaining access to that origin&#39;s cookies, storage, and same-origin scripting.</p> <p>Apps are only affected if they embed untrusted content in iframes sandboxed with `allow-scripts allow-popups`. Apps that do not embed untrusted content in sandboxed iframes are not affected.</p> <p>### Workarounds</p> <p>Use `setWindowOpenHandler` on the parent `WebContents` to deny or constrain popups opened from sandboxed frames, or do not apply `allow-popups` to sandboxed iframes that render untrusted content.</p> <p>### Fixed Versions</p> <p>* `43.0.0` * `42.5.2` * `41.10.4`</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)</p> https://db.gcve.eu/vuln/ghsa-hq2x-r82h-9wj4